[jatmn]

Summary

Moves gitlawb-node's libp2p dependencies to the libp2p-core 0.44 release line. This fixes three high-severity Dependabot alerts:

• #1: hickory-proto, GHSA-3v94-mw7p-v465 / RUSTSEC-2026-0118, NSEC3 closest-encloser unbounded loop.
• #18: hickory-resolver, GHSA-5j98-2g5x-46v6, lookup()/lookup_ip() hide DNSSEC validation failures.
• #15: libp2p-quic, GHSA-5hq8-qhww-jm7q, remote panic from a certificate-expiry race in the QUIC handshake.

Motivation & context

No GitHub issue is filed for these; they come from the Dependabot alerts above.

hickory 0.25.2 only enters the build through libp2p-dns 0.44, and no 0.44.x release moves to hickory 0.26. libp2p-dns 0.45.0 (released 2026-09-11) is the first one on hickory 0.26. That is the trigger .cargo/audit.toml named for dropping the RUSTSEC-2026-0118/0119 ignores ("REMOVE both once libp2p-dns ships a release using hickory 0.26").

libp2p-dns 0.45 requires libp2p-core ^0.44 and libp2p-identity ^0.3, so the other libp2p crates and multiaddr have to move with it. That also takes libp2p-quic to 0.14.0, which includes the #15 fix (patched in ≥ 0.13.1).

Kind of change

• Bug fix
• Feature
• Security fix
• Docs
• Tests / CI
• Refactor (no behavior change)
• Breaking or protocol change (issue required first)

What changed

Crate touched: gitlawb-node, manifest and lockfile only. No Rust source changes.

• crates/gitlawb-node/Cargo.toml:
  • libp2p-core 0.43 → 0.44, libp2p-identity 0.2 → 0.3
  • libp2p-gossipsub 0.49.4 → 0.50, libp2p-identify 0.47 → 0.48, libp2p-kad 0.48 → 0.49
  • libp2p-quic 0.13 → 0.14, libp2p-swarm 0.47 → 0.48, libp2p-dns 0.44 → 0.45
  • multiaddr 0.18 → 0.19, to match libp2p-core 0.44.
• Cargo.lock: hickory-proto and hickory-resolver go from 0.25.2 to 0.26.3, and hickory-net 0.26.3 is new. libp2p-quic goes to 0.14.0 and libp2p-tls to 0.7.0.
  • The new libp2p releases force these other changes. I checked each with cargo update --precise <old> --dry-run, and every revert is refused:
    • tokio 1.50 → 1.54.1: libp2p-quic needs ^1.53. This also clears RUSTSEC-2026-0386.
    • mio 1.2: needed by tokio 1.54.
    • regex 1.13 and bytes: needed by gossipsub 0.50.1.
    • either: needed by libp2p-core 0.44.
    • wasm-bindgen and js-sys downgrade to 0.2.108 and 0.3.85: libp2p-swarm 0.48 pins wasm-bindgen-futures =0.4.58. These are wasm-only crates and aren't built for our targets.
  • gossipsub now uses prost instead of quick-protobuf.
  • ed25519-dalek 3 arrives through libp2p-identity 0.3, alongside the existing ed25519-dalek 2 in gitlawb-core.
• .cargo/audit.toml: removes the RUSTSEC-2026-0118/0119 hickory ignores and the header paragraph about them. The scheduled audit's drift guard (audit-schedule.yml) passes again because the ignores are gone. The rsa and crypto-bigint ignores are unchanged.

How a reviewer can verify

grep -A1 -E 'name = "(hickory-proto|hickory-resolver|libp2p-quic)"' Cargo.lock
cargo audit                                         # cargo-audit 0.22.2
cargo +1.91 check --locked --workspace --all-targets
cargo clippy --locked --workspace --all-targets -- -D warnings
DATABASE_URL=... cargo test --locked --workspace

Local results, all on 46cb246 (this PR's head):

• cargo fmt --all -- --check: pass.
• cargo clippy --locked --workspace --all-targets -- -D warnings: pass.
• MSRV, cargo check --locked --workspace --all-targets on rustc 1.91.1: pass.
• cargo audit (0.22.2): exit 0, 9 allowed warnings.
• cargo audit with no ignores applied: compared with main, the only advisories gone are RUSTSEC-2026-0118, RUSTSEC-2026-0119 and RUSTSEC-2026-0386 (tokio). No new advisories.
• scripts/check-gitlawb-core-deps.sh: OK.
• cargo build --locked --release --workspace: pass.
• docker build . plus a --version smoke run: pass (gitlawb-node 0.7.1).
• cargo test --locked --workspace --no-fail-fast against a local Postgres 16: 1688 passed, 4 failed, 4 ignored. None of the 4 failures comes from this change:
  • api::ipfs::tests::get_by_cid_per_source_cap_sheds_same_source_admits_other and test_support::tests::git_receive_pack_not_shed_by_exhausted_read_pool fail every time on my machine, on main (151d688) too. CI on main is green, so this looks like something in my local environment.
  • git::smart_http::tests::info_refs_times_out_a_hung_advertisement and test_support::tests::sweep_backs_off_after_a_run_that_repairs_nothing failed under full-suite load. They pass 3 of 3 runs in isolation on both main and this branch.
• Two-node P2P smoke test with release binaries. Node B dials node A at /dns4/localhost/udp/<port>/quic-v1/p2p/<peer>, so the dial goes through libp2p-dns/hickory into QUIC. Both sides log connection established and identify received in all three pairings:
  • this branch to this branch
  • main listening, this branch dialing
  • this branch listening, main dialing

Limitations:

• The cross-version smoke only covers the connection, the QUIC/TLS handshake, protocol negotiation and Identify. Gossipsub ref-update propagation and Kademlia record exchange between old and new nodes are not exercised.
• I didn't run the Windows or beta-toolchain test jobs locally.

Before you request review

• Scope is one logical change; no unrelated churn
• cargo test --workspace passes locally: all but 4 tests pass. The 4 failures are local-environment issues or timing flakes, not caused by this change (see above).
• New behavior is covered by tests (required for fixes): N/A, dependency-only change with no behavior change in our code
• cargo fmt --all and cargo clippy --workspace --all-targets -- -D warnings are clean
• Commit titles use Conventional Commits (feat(...), fix(...), docs(...))
• Docs / .env.example updated if behavior or config changed (or N/A)
• Checked existing PRs so this isn't a duplicate

Protocol & signing impact

• Touches DID / did:key, Ed25519 / RFC 9421 signatures, UCAN, ref certs, or P2P wire formats: the libp2p stack carries the P2P wire formats, but none of our message formats change.
• Discussed in an issue before implementation
• Backward-compatible with existing nodes and previously signed history: mixed-version connection and Identify were checked with the smoke test above. Gossipsub and Kademlia were not exercised across versions.

Notes for reviewers

#462 edits the Identify → Kademlia address handling in p2p/mod.rs. Whichever of the two merges second may need a rebase, but they don't overlap in scope.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Security audits will now report two advisories that were previously excluded. Existing exceptions for other advisories remain unchanged.
  • Updated the application’s underlying networking components. No user-facing behavior changes are specified in this update.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The node crate updates its libp2p dependencies. The audit configuration removes the ignore entries for RUSTSEC-2026-0118 and RUSTSEC-2026-0119.

Changes: Node dependency updates

Layer / File(s)	Summary
Update libp2p dependencies and audit configuration .cargo/audit.toml, crates/gitlawb-node/Cargo.toml	The node crate updates libp2p dependency versions, including libp2p-dns. The audit configuration removes the Hickory advisory tracking comments and ignore entries.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Twigpine/node#518: This PR makes the same libp2p dependency upgrades and removes the Hickory advisory ignores.

Suggested labels: crate:node

Suggested reviewers: beardthelion, vasanthdev2004

Merge Risk: Minimal · up to 46cb2

No actionable merge-blocking risk was identified in the dependency update.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the dependency upgrade and its purpose of addressing Hickory and QUIC advisories.
Description check		The description is detailed and follows the required structure. It explains the security motivation, lists concrete dependency changes, documents verification results and known test limitations, and i…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description is detailed and follows the required structure. It explains the security motivation, lists concrete dependency changes, documents verification results and known test limitations, and identifies compatibility impact. The missing issue reference is explained because no GitHub issue was filed.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: bc01a9ed-0527-4e69-b545-8ef52e400ef4

Commits

Reviewing files that changed from the base of the PR and between 151d688 and 46cb246.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 2

• .cargo/audit.toml
• crates/gitlawb-node/Cargo.toml

Files with no reviewable changes: 1

• .cargo/audit.toml

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

[jatmn]

Merge readiness

• Overlapping open PR #518: fix/hickory-serde-with-advisories applies the same libp2p/hickory/audit.toml bump and additionally bumps serde_with to 3.22 (Dependabot #14) and closes #76. Landing both would duplicate lockfile churn; prefer one coordinated PR or merge #518 and close #517 as superseded.

• Stacked work with #462: The PR notes that #462 touches p2p/mod.rs Identify→Kademlia address handling. Whichever merges second should rebase; no file overlap in this diff, but resolve order before relying on combined P2P behavior.

• CI: Confirm required jobs (test (stable), test (beta), build --release, Docker smoke, remaining CodeQL) are green on the merge commit before merge.

• Issue tracking: This PR removes the hickory ignore block that referenced GitHub issue #76 but does not list Closes #76 in the body (unlike #518). Close or cross-link #76 when merging so tracking stays accurate.

Findings

🟢 Thanks for the contribution. I do not see any actionable issues from my review.

The dependency bump matches the documented removal condition for the hickory audit suppressions, resolves the stated Dependabot targets via lockfile versions (hickory-* 0.26.3, libp2p-quic 0.14.0), and leaves only the long-standing rsa/crypto-bigint ignores. No Rust source changed; compile and audit gates on head look consistent with a security-only dependency refresh.

[Copilot]

🔵 Needs a closer look

Maintainer runtime validation is still needed for cross-version signed Gossipsub ref-update propagation and Kademlia DID-record exchange, as reported mixed-version checks cover only QUIC and Identify.

No open issues 🎉

What changed in this PR

Updates gitlawb-node’s P2P dependencies to the libp2p-core 0.44 release line to address Hickory DNS and QUIC security advisories, without changing Rust source code.

Changes:

• Upgrades the coordinated libp2p crates and multiaddr.
• Locks Hickory to 0.26.3 and libp2p-quic to 0.14.0, with required transitive dependency updates.
• Removes the two obsolete Hickory audit exceptions while retaining unrelated exceptions.

File	Description
crates/​gitlawb-node/​Cargo.toml	Updates libp2p and multiaddr version requirements.
Cargo.lock	Records upgraded P2P, DNS, cryptography, and runtime dependencies.
.cargo/​audit.toml	Removes resolved Hickory advisory ignores and their explanatory comments.

_{Review effort: Balanced}

[jatmn]

Closing as superseded by #518 (merged as 623b600), which applies the same libp2p 0.44-core / hickory 0.26.3 / libp2p-quic 0.14 bump and drops the RUSTSEC-2026-0118/0119 ignores, plus the serde_with 3.22 bump. Rebasing this branch onto main would leave an empty commit.